New article
Recently updated
Setting up Google Workspace for SAML-based Single Sign-On (SSO)
Who is this article for?
Administrators responsible for managing organization security settings in Ideagen Hub.
Admin Console access is required.
You can set up Google Workspace as your corporate identity provider (IDP) in Ideagen Hub using SAML, which is the preferred protocol since Google Workspace has limited OIDC SSO support.
To use an external identity provider like Google, you will need to ensure the Hub user's authentication type is set to External.
This article outlines how to configure a new SAML app in the Google Workspace Admin console and link it to Ideagen Hub.
1. Creating an SAML app
To create a SAML app in Microsoft Entra:
Go to Google Workspace.
Log in to the Admin console.
Expand Apps.
Select Web and mobile apps.
Click Add app.
Select Add custom SAML app.
Enter a name for your app.
Click Continue.
Click Download Metadata.
Keep the file in a secure place where you can easily access it, as you will need to upload it to Ideagen Hub later to finish setting up the SSO configuration.
2. Configuring the SAML app
2.1. Identifier and Reply URL
Once you have created the SAML application in Google Workspace, you will need to configure the Identifier and Reply URL.
To configure these:
- Sign in to Ideagen Hub.
- Navigate to the Admin Console.
- Go to the Security Center.
- Select Authentication.
- Select Eternal IDP Configuration.
- Click Add Identity Provider.
- Select SAML.
- Click Next.
You will see the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL).
- Copy these values to your identity provider app.
- Click Continue.
Note
Entity ID represents an organization or a single Ideagen Hub subdomain.
3. Configuring attribute mapping
3.1. Email attribute
Whether your organisation uses Email as the login identifier, you will need to add the email attribute in Google Workspace and map the email attribute in Ideagen Hub.
To configure the attribute:
Go to the application in Google Workspace.
Select Primary email under Google Directory attributes.
- Set the value to email.
- Copy this value.
- Go to Ideagen Hub.
- Scroll down to the Attribute mapping section.
- Paste the attribute name in the SAML attribute field next to the email User pool attribute.
3.2 Username
If your organisation uses Username as login identifier, you must map the email and preferred_username attributes in Ideagen Hub.
To configure the attribute:
Go to the application in Google Workspace.
Click Add mapping.
- Create an attribute with a unique, unchanging value for each user.
For example, employee_id. - Copy this value.
- Go to Ideagen Hub.
- Scroll down to the Attribute mapping section.
-
Paste the claim name in the SAML attribute field next to the preferred_username User pool attribute.
5. Activating the app
When the SAML app is created in Google Workspace, it will be off for everyone by default.
To activate the app:
- Click the Arrow next to User access.
- Assign users by Groups or Organisation Units.
- Set Service status to ON.
- Click Override.